Approximate quantum state sharing via two private quantum channels 
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We investigate the approximate quantum state sharing protocol based on random unitary chan- 
nels, which is secure against any exterior or interior attackers in principle. Although the protocol 
leaks small information for a security parameter e, the scheme still preserves its information-theoretic 
secrecy, and reduces some pre-shared classical secret keys for a private quantum channel between 
a sender and two receivers. The approximate private quantum channels constructed via random 
unitary channels play a crucial role in the proposed quantum state sharing protocol. 
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I. INTRODUCTION 



Quantum physics allows us a perfect randomness, so most of all quantum information-theoretic primitives try to 
offer an unconditional security under the randomness. For examples, quantum key distribution protocols such as 
BB84 l] and B92 [2] highly depend on a random measurements for given classified non-orthogonal quantum states, 
i— i . Instead of the random measurement on non-orthogonal states, we can consider a direct randomization of quantum 
' states through a quantum channel. This randomizing procedures are efficiently accomplished via the private quantum 
channels (PQC) or quantum one-time pads 3]. In the paper we are interest to some schemes for approximate 
encryptions (no perfect) and we make an attempt to reducing some classical communication resources. We would 
like to call the randomizing procedures or maps as random unitary channels (RUC) in terms of quantum channels. 
There are several methods for the approximate randomizing quantum states, for examples, [1,0, Q : We here adapt 
qh| the procedure of Hayden et al. [4| . 

Many applications of RUC in quantum protocols (See e.g., [1, ||| 0]-) are started from the approximate version of 
PQC. Here we will propose new approximate quantum state sharing (AQSS) scheme, which uses two approximate 
PQCs (APQC) and reduces the classical pre-shared secrets about one-half as compared with a perfect protocol. 
Actually our protocol could be including the (well-known) quantum secret sharing protocols (9l.[l0|. because a quantum 
state itself is able to operate special quantum tasks, though those are impossible in the classical power. Imagine that 
CSJ ■ if there is a quantum computer only activated under a bipartite quantum state (or quantum key), then our AQSS 
protocol will give a efficient and secure solution for the quantum key. These approximate quantum state sharing 
H ■ protocols may offer us more opportunities as compared with the quantum secret sharing. 

t-H ' Let's take account of the pre-shared secrets for the approximate quantum state sharing protocols under RUC-based 
PQC roughly. Assume that a sender Charlie prepares a quantum state <pab (two-qudit) and transmits the state 
through two independent RUCs, then two distant agents Alice and Bob will receive some output state of including 
high entropy. For the state <pab the perfect randomization protocol will require exactly the amount of 4 log d-unitary 
matrices (Pauli matrices). On the other hand, the construction of Hayden et al. [4| for our AQSS scheme implies that 
only 21ogd + o(log (i)-unitaries sufficient. In other words, the perfect quantum state sharing protocol needs to 21 bits 
of pre-shared secret information, while the AQSS protocol demands about I bits of information. Note that the works 
in [5, 8] will give a similar result for I bits bound. 

We will prove the information-theoretic security of the AQSS scheme in two kinds of eavesdropping: an interior 
and exterior attackers. The proof of having higher entropy condition for the exterior attacks is not easy fact, so we 
split the input state ipAB to separable and entangled cases. As a result, the von Neumann entropy in both cases can 
be chosen sufficiently larger, and a leakage information will be arbitrarily small. Finally the authors show that our 
bipartite AQSS scheme naturally can be generalized to an one-sender and multiparty-receivers schemes. 

In section [II] we introduce the definition of random unitary channels, and briefly mention about special property 
known as the destruction of quantum states on a product random unitary channel. We present our AQSS protocol 
based on two approximate PQCs in section HTT1 and investigate the security of AQSS of considering two attacks: an 
exterior and interior strategies, we finally conclude our results in section [TV] 
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FIG. 1: Approximate private quantum channel: 
logn bits classical information. 



Alice applies some Ui's and Bob decodes J\f(<p) with i of having pre-shared 



II. SOME PROPERTIES OF RANDOM UNITARY CHANNELS 



Now let us define the random unitary channel, and then construct an approximate private quantum channels. For 
all density matrices ip £ B(C d ), a completely positive trace-preserving map Af : B(C d ) — > B(C d ) is the so-called 
e -randomizing, if 



< e, 



(1) 



where the trace norm is defined by ||X||i = \XXX. This definition directly induces the notion of random unitary 
channels. That is, for every ip, a quantum channel J\f : B(C d ) — > S(C d ) is called the random unitary channel, if 



W<p) = Y,PiUi<pU} 



(2) 



is e-randomizing, where the unitary operators Ui £ 14(d), and the probability p^s are all positives with Y^iPi = 1. 
(The notation B(C d ) denotes the set of bounded linear operators from C d to itself and U(d) C B(C d ) the unitary 
group on C d .) Note that the parameter n is the number of Kraus operation elements for RUC, so it corresponds to 
the dimension of arbitrary environment. 

For the approximate constructions of RUC, it was known that for all e > there exist random unitary channels in 
sufficiently larger dimension d, such that n can be taken to be 0(d\ogd/e 2 ) in Q and 0(d/e 2 ) in [l2| where Ui's are 
chosen randomly according to the Haar measure. We here fix the number n of having exactly n — the Theorem 
1 in p]|. 

As mentioned in the Introduction, most intuitive application of the random unitary channel is the approximate 
private quantum channel which is a modification of the perfect private quantum channel Q via RUC. The RUC- 
based APQC is the main tool of constructing the proposed AQSS protocol. 

The security of PQC is preserved by the argument of the accessible information in which the leakage information is 
less than e. Although small information is leaked to exterior attackers, Bob's decoding state is almost equal to Alice's 
original state ip. The FIG. [1] describes the total procedure of APQC. 

In the next section we use two one-way independent PQCs between a sender Charlie and a receiver Alice, and the 
sender Charlie and another receiver Bob. Let's define two RUCs, from the definition of (Eq. ([2])), such that 



M A {p) : = — YUtpU} and 

l—l 

^ nB 

N b (p) ■ = —Y,Ui<pU], 



(3) 



where we fix the probability as an equally weighted probabilities pi = and pj = ^ for all i,j, and assume that the 
number of ha is equal to ub, i-e., ua — tib — 150d/e 2 . For an approximate state sharing of any bipartite quantum 
state, above two channels play an important role in the approximate quantum state sharing scheme. 
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FIG. 2: Approximate QSS: If Charlie-Alice and Charlie-Bob have shared two independent PQCs each other, then the product 
channel Ma ®Mb preserves the security with high probability for any attacks. The arrow denotes that Alice must go to Bob's 
location to obtain the state. 



For given two RUCs Ma and Mb , and for all input <pab , we must bound the trace norm for the difference between 
an output state of the product channel Ma ® -Mb and maximally mixed 1/d 2 , such that 



{M A ®M B ){v 



ab) 



< e, 



(4) 



where a security parameter e be a positive less than 1. The relation above asserts that all encoding states are 
information-theoretically secure. Unfortunately, for any entangled states proving the bound is not a simple task. 

Note that the argument for the (efficient) randomization is related to a destruction of correlations in quantum 
states [H, fllj . They pointed out that the unitary operations of the amount corresponding to the quantum mutual 
information I [A : B] = S\tfA\ + ■S'l'y's] — S[lpab] efficiently destroy the total correlation of any quantum states [Tl| , 
where S[g] = —trglogg the von Neumann entropy. For the maximally entangled state (p A B = 2^ij N*)0'jIab' 
I[A: B]= 21ogd, which might be related to the Eq. ([3]). 

The following section gives the AQSS protocol and the security of the protocol. The last of the section, we briefly 
describe a multiparty AQSS scheme. 



III. APPROXIMATE QUANTUM STATE SHARING PROTOCOL 

Let us assume that Charlie- Alice and Charlie-Bob have independent two APQCs, and Charlie wants to sharing a 
bipartite quantum state ifAB securely between Alice and Bob. 

The protocol for a bipartite quantum state sharing is simple (See FIG. [5]): 

(i) The sender Charlie selects a quantum state ifAB and transmits the state through the channel Ma ® Nb to the 
receivers Alice and Bob. 

(ii) Distant two parties Alice and Bob just hold the state Ma <8> Nb{<Pab) they received. 

(iii) When Alice and Bob want to reveal the original state tp A B, they must cooperate in a single location. They 
perform the inverse unitary operations under the locally shared keys. 

The security of the AQSS protocol is divided two cases of an exterior and interior attacks. Actually the security 
is based on information-theoretic assumption, which means that the intercepted states must have the higher von 
Neumann entropy. Thus any attackers cannot obtain sufficient information for the original states. 

First, let us consider an attack accomplished by an exterior Eve. Assume that Eve intercepts the state Ma ® 
Mb{^Pab)- We here claim that 

S[{Ma®Nb){vab)} ~21ogd-)-oo (5) 

as d goes to infinity We don't know the accurate description for the state Ma <8> Nb(<Pab) for all inputs, so we will 
divide the state ifAB into the separable and entangled one and investigate the behavior each other. 

If product state is given, it is possible to infer the inequality Eq. Q easily. By using the triangle inequal- 
ity with respect to the trace norm for the two RUCs, if — ir||i — e an d \\Nb{^Pb) ~ if||i < £ > then 



4 



1 1 (A/a ® Mb)(<Pab) — < 2e for (/3ab = ^>a®^Pb- More formally assume that lpab = "}2 i Pi l PA,i® i PBd such that 

^2iPi = Ij i- e -j a separable state is given, then 



(A/a ®M b )(<Pab) 



ias 



d 2 



= E? 

< 5> 

< 2e, 



y^P»A/ Apl 'A,j) <8> M B {WB,i) ' 



IAS 



d 2 

Ias 



M A ((pA,i)®M B ((pi 



M A (<Pj 



1a 

d 2 



d 2 

-Ma^a/, 
A/s^s.i) 



(6) 



Is 

d 2 



-A/a(v? 



Is 
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J-AS 



rf 2 



(7) 



where the inequalities Eq. © and Eq. ([7]) come from the norm convexity and the triangle inequality, respectively [3] . 
Thus any separable inputs for the product channel are very close to the maximally mixed state -4 . This implies that 
S[(Ma ®M b ){vab)] is close to 21ogd. 

For the separable input cases, there is another bound that depends on the dimension parameter d and n: We can 
prove that the expectation value for the difference between the channel output and the maximally mixed state (with 
respect to the trace norm) is very close, that is, 



E 



(A/a<8A/ s )(¥'ab) - 




(8) 



where .} denotes the total expectation value of {L^}"^ and for the independent RUCs Ma and A/"b, 

respectively. The Appendix in this paper states that the inequality Eq. (|S]) is non-trivial and obtained precisely 
by exploiting the relation between the trace norm and the Hilbert-Schmidt norm. As mentioned above, let's take 
and n B = then 



it A 



^n A n B 150 



< e. 



(9) 



This implies that Eve's attack is impossible in principle. 

What can we do for an entangled input state? Though a direct proof could be impossible, there is an evidence for 
the statement, the Eq. ([5]). The Theorem III. 3 in 0] states that, for a positive operator- valued measure (POVM) 
{Li} which is implemented using local operation and classical communication (LOCC), \\pi — qi\\i < e, where 
Pi := tr(ij(A/A® ls)(<PAs)) and ^ := tr(L t (^f <E> ip B )) with a maximally entangled state s.t. Lp A B = \ NKxj Iab 
and (fB = tr AfAB- Natural extension is possible as adding the channel Mb- Define pi = ti(Li(J\f A <8> Mb){vab)) and 
qi — tr(L i (^ a -)), then also J^i \\Pi ~ ftlli — £ - Therefore, we can conclude the state Ad ® Mb{^Pab) is close to jp 
under the LOCC-implemented POVM. In this reason any input state <pab through the product channel Ma <8> As 
have high entropy for d> 1. 

Second, we must consider a situation when Alice or Bob is malicious. Assume that Bob intercepts the Alice's state 
Ma(<Pa), Bob's decoded state looks like 



{M a ®M b ){Ma®Mb){vab) = (A/a® 1s)(vab), 



(10) 



where * denotes the inverse operation for Bob's RUC Mb, but S[Ma(<Pa)) has still high entropy values. The intercepted 
state tr B (Ma <8> 1s)(v?as) is still almost maximally mixed state by the definition of the RUC A/a(v>a)- As a result, 
Bob cannot obtain any information for tpA without Charlie- Alice's key information. Symmetrically Alice's attack is 
useless. In other words, the Charlie's aim of sharing a quantum state ifAB between Alice and Bob will be securely 
accomplished. 

At least above-mentioned two attacks (exterior and interior eavesdropping) cannot break the security of the proposed 
AQSS protocol, so the cooperation between Alice and Bob always restores the original state approximately. 

In the proposed scenarios, the perfect protocol for quantum state sharing requires exactly d 4 unitary operators, 
while our protocol only needs to total 22500d 2 /e 4 unitaries for sufficiently larger d. This fact directly means that 
some pre-shared key bits are reduced by factor 2, since the AQSS is needed 2 log d — 4 log £ + 0(1) secret bits, but the 
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perfect QSS is required 41ogd bits. For any state (fiAB € 
let's consider a relation like that 



d ) , and for any channel Nab (for an e > is arbitrary) , 



Nab{^ab) - -p 



< e. 



(11) 



Then, it is sufficient to construct the perfect QSS (e = 0) with d 4 Pauli operators for the channel Nab in the sense of 
PQC HI. In the case of our approximate QSS, the product channel of two RUCs (Nab = Na ®Nb) just consume 
of half secret bits, so we say that it is efficient in weak sense (though small information is always leaking). 

Without loss of generality, a direct extension of the bipartite quantum state sharing protocol (Eq. ([8])) gives the 
security of a multiparty approximate quantum state sharing (MAQSS). Assume that a sender Charlie (C) prepares 
an m-qudit <-PA 1 A 2 ---A m - If they initially have shared PQCs between C-A\, C-Ai and so on, then, for any e > 0, 



) NA m )(<fA 1 A 2 ---A, 



l > d m 



< 



(12) 



The above Eq. (fl"2|) implies that any exterior attacks will be failed. Furthermore all interior attacks (including group 
conspiracy) will be frustrated to obtain the whole state without others secrets, it has similar reason to the two receivers 
protocol. Let's look at the cost of secret bits for the MAQSS scheme. Roughly speaking, the perfect scheme requires 
2m log d secret bits, but MAQSS only m\ogd + o(log cQ-bits sufficient. 



IV. CONCLUSIONS 



We studied that the approximate quantum state sharing schemes are efficient from the classical information cost 
of view and those are robust to the two kinds of attacks. The proposed AQSS protocol basically depends on an 
approximate private quantum channel, which is constructed via two independent random unitary channels. Although 
the protocol leaks small information corresponding to the security parameter e, the scheme preserves its information- 
theoretic security, and so the AQSS and MAQSS schemes can be interpreted as some high-efficiency state sharing 
protocols for any bipartite and multipartite quantum states. 
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Appendix 



For given two random unitary channels Na (<^) and Nb (<^) in Eq. ([3]) , and for all pure-separable states ipAB € B(C d ), 



\\(N a ®Nb)(<Pab)\\ 2 = ^(Na ® Nb) (<Pab) 



A B i=1 j = i 



2 



^ n A n B 

+^T^ E E tr ( u i ® VwabV\ ® Uj) (u k ® UwabUI ® Uf] , (13) 



n A n R ^77 TT, 



where tr (lJi ® UjipABUj llj^j = 1 for any pure states ipAB- (Note that this method is just an extension of the 

statement, the chapter 3 in Q.) 

Recall that the unitary operators are chosen randomly according to the Haar measure, and take expectation over 
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the random selection of unitaries: 
E {Uz j} [tr{Af A ®Af B ) 2 (ip AB )] 



n A n B 



1 



1 



tr 



1 tr ^4 

n A n B or 
1 1 



} (u, ® Ujif AB Uj ® C/]) E {[/jm} (t/fe ® UhpabUI ® (7/)] (14) 

(15) 
(16) 



In Eq. (|14p. we have used that E/jj and £7^ are chosen independently, and Eq. (|15p inherited from the definition of the 
Haar measure. (For any (/? S S(C d ), a Haar-distributed set U := {t/j}" =1 satisfies that EuUipU^ = J UfWdU = 4.) 
The Eq. (fT5|) exploits the separable condition for (p AB . Note that for any rank d matrix X \\X\\i < \/d\\X\\2- For any 
rank d 2 matrix X , a generalization of the Corollary A. 2 in [8( directly show that 



X 



l A 



d 2 



< d 2 \\X\ 



1. 



(17) 



Then, from considering the random variable Y := ||(7Va ® N B )((p AB ) — and Eq. (JT6 



< 



(18) 



d 2 



n A n B 
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